cryptomator / cryptomator/cli

Feature: Provide means to use shared memory blob as password (automation, preventing accidental leakage)

Open
#2 11 comments 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
Java
Stars
427
Forks
52
Avg merge
20h 37m
Merged PRs (30d)
2

Description

_From @heinrich-ulbricht on June 10, 2016 13:3_

This is a feature proposal concerning interoperability and integration with external tools and scripts.

What about a way to pass a password to Cryptomator **without having to enter it manually** (=automation) while **preventing the password from (accidentally) leaking** to log files.

#1 one day probably solves the first requirement: automation. But passing passwords via command line bears the risk of some tools (system log, usual logging tools) capturing the command line and thus the password.

Could we instead provide a pointer to a more volatile location in (shared) memory? Another tool could put the password there and launch Cryptomator with a pointer to the shared memory location. A nice service of Cryptomator could be to erase the memory right after reading the password.

The password thus should be safe from accidental leakage. Only if an attacker explicitly targets this mechanism he would be able to get the password from memory. But usual key loggers, general purpose monitoring tools etc. are no danger anymore.

(Note: key files are no solution for me since even a temporary file might somehow be mirrored by backup software.)

What do you think?

_Copied from original issue: cryptomator/cryptomator#290_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.